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DETAILED ACTION 
Specification 

1 . The disclosure is objected to because of the following informalities: In claim 10 
line 3 claimed "IP hash table", which is not explained in the specification. Appropriate 
correction is required. 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1,2,4-9,1 1,18-22, and 29 are rejected under 35 U.S.C. 103 (a) as being 
unpatentable over Bussiere (6,041,042) in view of See (U.S.2004/0003094). 

Regarding claim 1, Bussiere discloses a method for remote mirroring of network 
traffic, the method comprising: 

receiving a data packet (Bussiere , 20, fig 3) to be remotely mirrored by an entry 
device pre-configured with a destination (Bussiere, col. 5, lines 44-49; col. 8, lines 55- 
58) to which to mirror the data packet (Bussiere, 20, 32, fig 3, col. 5, lines 35-49; col. 5, 
line 65 to col.6, line 11); 
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generating and adding an header to encapsulate the data packet (Bussiere, 25, 
fig 3, col 5, lines 35-49; col 5, line 65 to col 6, line 1 1 ), 

wherein the header includes the destination address (Bussiere, packet is 
prepended by encapsulation logic which discloses the path to reach the analyzer 
destination address, 25, fig 3, col 5, lines 35-49; col 5, line 65 to col 6, line 20); 

forwarding (Bussiere, 26, fig 3) the encapsulated packet to an exit device 
(Bussiere, 29, fig 3) associated with the destination address (Bussiere, 26, 29, fig 3, 
col 5, lines 35-49; col 5, line 65-col 6, line 20). 

Bussiere discloses generating and adding a header to encapsulate the data 
packet (Bussiere, column 5, line 66-col.6, line 20). Bussiere does not specifically 
disclose IP headers and IP addresses. Bussiere does teach generating headers and 
adding a header for data packets transmitted over a WAN (col 8, lines 55-58). 
However, See, in the same field of endeavor, discloses encapsulating a packet with an 
IP header and an IP address for mirroring network traffic (See, Paragraphs 0038 -0039). 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of See's method to modify in Bussiere's 
method. The motivation would have been to update the invention of Bussiere to be 
used within the internet environment. 

Regarding claim 2, Bussiere-See further discloses further discloses 
determining a media access control (MAC) address associated with the 
destination address (Bussiere, col 4, lines 48-59; col 7, lines 35-67); 
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generating (25, fig 2) and adding a MAC header to the encapsulated packet to 
form a MAC data frame (Bussiere, col 4, lines 48-59; col 7, lines 35-67) , wherein the 
MAC header includes the MAC address in a destination field (Bussiere, col 4, lines 48- 
59; col 7, lines 42-67); 

transmitting (26, fig 3) the MAC data frame to communicate the encapsulated 
packet, across a layer 2 domain (egress device, fig 1 , col 1 , lines 35 -54). See, 
discloses the IP header and IP address (See, Paragraphs 0038 -0039). 

Regarding claim 4, Bussiere-See further discloses, wherein the IP-encapsulated 
packet is communicated across at least one intermediate layer 2 domain (See, fig.4, 
452 and 406, packet is communicated with Iayer2, Paragraph 0053). 

Regarding claim 5, Bussiere-See further discloses receiving the IP-encapsulated 
packet (See, paragraph 0007) by the exit device (Target network device is a exit device, 
See, Fig.2, 110, paragraph 0038); 

removing the IP header to de-encapsulate the packet (Mirrored Flow 
encapsulated header is removed, See, paragraph 0049) 

Regarding claim 6, Bussiere-See further discloses wherein the remote mirroring 
preserves an original format of the data packet (Ingress device preserve original format 
of the data packet, Bussiere, Fig., col. 7, lines 25-40) (See, paragraph 0049). 
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Regarding claim 7, Bussiere-See further discloses pre-configuring the entry 
device (ingress device) to mirror data packets from at least one specified port 
(Bussiere, mirror from port, fig.2, 13) of the entry device (Bussiere, fig. 2, col. 5, lines 7- 
27) 

Regarding claim 8, Bussiere-See further discloses pre-configuring the entry 
device (Bussiere, ingress device). Bussiere fails to disclose mirror data packets which 
includes a VLAN tag with at least one specified VLAN identifier. However, See in the 
same field of endeavor, discloses mirror data packets (See, fig. 1 , 106, Source network 
device is entry device to mirror data packet, paragraph 0029), which includes a VLAN 
tag with at least one specified VLAN identifier (See, paragraphs 0017 and 0039). 

It would have been obvious to one have ordinary skill in the art at the time 
of the invention was made to combine the teaching of See's method to modify in 
Bussiere's method. The motivation would have been increase the effectiveness of the 
invention of Bussiere by using virtual network. 

Regarding claim 9, Bussiere discloses pre-configuring the entry device (Bussiere, 
Fig.2, col.5, lines 6-11). Bussiere fails to disclose Mac look-up table. However, See in 
the same field of endeavor, discloses pre-configuring the entry device to mirror data 
packets which include MAC addresses that match at least one entry in a MAC look-up 
table (lookup cache Fig.2, 224 determine how the packet is to be processed ENCAP 
(220), DECAP (222), paragraphs 0035 and 0039). 
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It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of See's method to modify in Bussiere's 
method. The motivation would have been to help the packet route to the destination 
host. 

Regarding claim 11, Bussiere-See further discloses pre-configuring the-entry 
device to mirror data packets (See, fig.1, 106, Source network device is entry device to 
mirror data packet, paragraph 0029), which include an IP destination address that 
matches at least one specific subnet entry (the source network devices, See, 
paragraph 0045) in a best matching prefix (BMP) table (conventional destination 
address table match the source address, See, paragraph 0045). 

Regarding claim 18, Bussiere discloses a networking device comprising: 

a plurality of ports for receiving and transmitting packets therefrom (Bussiere, 
fig.2, there is a plurality of ports for receiving and transmitting packets, col.5, lines 7-39); 

a switching/routing engine (a router engine acts as a junction between two or 
more networks to transfer data packets among them, Bussiere, fig.2) coupled to the 
ports for transferring the packets there between (ingress device, trunk device, egress 
device they are transferring the packets, Bussiere, fig.2, col.5, lines<7-39); 

a remote mirroring engine configured to detect packets from a specified mirror 
source (Bussiere, fig.4, 41,42,43, col. 6, lines 38-50), encapsulate the detected packets 
(Bussiere, col.5, lines 20-50) and forward (Bussiere, 26,fig.3) the encapsulate packets 
to destination by way of least one of the ports Bussiere, 26,29,fig.3, col. 3, lines 35-49; 
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col. 5, Iine65- col.6, line 20). Bussiere does teach generating headers and adding a 
header for data packets transmitted over a WAN (col 8, lines 55-58). Bussiere does not 
specifically disclose IP header and IP-address. However, See, in the same field of 
endeavor, discloses encapsulating a packet with an IP header and IP address for 
mirroring network traffic (See, Paragraphs 0038 -0039). 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of See's method to modify in Bussiere's 
method. The motivation would have been to update the invention of Bussiere to be 
used within the internet environment. 

Regarding claim 19, Bussiere-See further discloses wherein the specified mirror 
source comprises at least one of said ports (Bussiere, col. 5, lines 6-11). 

Regarding claim 20, Bussiere-See further discloses wherein the specified mirror 
source (ingress device is a specific mirror source Bussiere, fig. 2, col. 5, lines 6-11), 
Bussiere fails to disclose VLAN. However, See in the field of endeavor, comprises at 
least one specified VLAN (See, paragraphs 0017 and 0039). 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of See's method to modify in Bussiere's 
method. The motivation would have been increase the effectiveness of the invention of 
Bussiere by using virtual network. 
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Regarding claim 21, Bussiere-See further discloses wherein the specified mirror 
source comprises those packets (Bussiere, fig. 2, col. 5, lines 7-27), However, See in the 
same field of endeavor, discloses matching entries in a look-up table (lookup cache 
Fig.2, 224 determine how the packet is to be processed ENCAP (220), DECAP (222), 
See, paragraphs 0035 and 0039). 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of See's method to modify in Bussiere's 
method. The motivation would have been to help the packet route to the destination 
host. 

Regarding claim 22, Bussiere-See further discloses wherein the specified mirror 
source comprises at least one specified subnet (Bussiere, fig.2, showed a subnet is to a 
network what a network is to an internet). 

Regarding claim 29, Bussiere-See discloses an apparatus for remote mirroring of 
network traffic, the method of claim 1 . applicants are invoking 35 U.S.C. 112, six 
paragraph with claim 29 which encompass a system including means for receiving a 
data packet, means for generating and adding an IP header, and means for forwarding 
the IP-encapsulated. 

means for receiving a data packet (Bussiere , 20, fig 3) to be remotely mirrored 
by an entry device pre-configured with a destination (Bussiere, col. 5, lines 44-49; col. 
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8, lines 55-58) to which to mirror the data packet (Bussiere, 20, 32, fig 3, col. 5, lines 35- 
49; col. 5, line 65 to col.6, line 11); 

means for generating and adding an header to encapsulate the data packet 
(Bussiere, 25, fig 3, col 5, lines 35-49; col 5, line 65 to col 6, line 1 1 ), 

wherein the header includes the destination address (Bussiere, packet is 
prepended by encapsulation logic which discloses the path to reach the analyzer 
destination address, 25, fig 3, col 5, lines 35-49; col 5, line 65 to col 6, line 20); 

means for forwarding (Bussiere, 26, fig 3) the encapsulated packet to an exit 
device (Bussiere, 29, fig 3) associated with the destination address (Bussiere, 26, 29, 
fig 3, col 5, lines 35-49; col 5, line 65-col 6, line 20). 

Bussiere discloses generating and adding a header to encapsulate the data 
packet (Bussiere, column 5, line 66-col.6, line 20). Bussiere does not specifically 
disclose IP headers and IP addresses. Bussiere does teach generating headers and 
adding a header for data packets transmitted over a WAN (col 8, lines 55-58). 
However, See, in the same field of endeavor, discloses encapsulating a packet with an 
IP header and an IP address for mirroring network traffic (See, Paragraphs 0038 -0039). 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of See's method to modify in Bussiere's 
method. The motivation would have been to update the invention of Bussiere to be 
used within the Internet environment. 
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3. Claim 3 is rejected under 35 U.S.C. 103 (a) as being unpatentable over Bussiere, 
(6,041,042) in view of See (U.S. 2004/0003094) as applied to claim 2 above, and 
further in view of Chari et al. U.S. 2004/0264435 A1 

Regarding claim 3, Bussiere-See discloses destination IP address and MAC 
address (See, paragraph 0016). Bussiere-See fails to disclose determining if a mapping 
of the destination IP address to the MAC address is stored in an address resolution 
protocol (ARP) cache; if so, then retrieving the MAC address from the ARP cache; if 
not, then broadcasting an ARP request with the destination IP address and receiving an 
ARP reply with the MAC. However, Chari, in the same field of endeavor, discloses 
determining if a mapping of the destination IP address to the MAC address is stored in 
an address resolution protocol (ARP) cache (Chari, paragraph 0067); if so, then 
retrieving the MAC address from the ARP cache (ARP is generally is protocol for the 
resolution of IP address to MAC address, Chari, paragraph 0067); if not, then 
broadcasting an ARP request with the destination IP address and receiving an ARP 
reply with the MAC (gateway then responds to the access node with the replay 
received, Chari, paragraphs 0067, 0068,and 0069) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Chari's method to modify in Bussiere- 
See's method. The motivation would have been used to identify the source and 
destination information from ARP to send packets mirroring from one network device to 
the other. 
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4. Claim 10 is rejected under 35 U.S.C. 103 (a) as being unpatentable over 
Bussiere, (6,041,042) in view of See (U.S. 2004/0003094) as applied to claim 1 above, 
and further in view of Howes et al. (6,445,704) 

Regarding claim 10, Bussiere-See further discloses pre-configuring the entry 
device data packet (SND device is entry device, See, fig. 1 , 106, Paragraphs 0029 and 
0053) See-Bussiere fails to disclose include IP addresses that matches at least one in 
an hash table. However, Howes, in the same field of endeavor, discloses include IP 
addresses that matches at least one in an hash table (Howes, col.1 1 , lines 41-50) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Howes' s method to modify in Bussiere- 
See's method. The motivation would have been increasing routing. 

5. Claims 12 and 23 are rejected under 35 U.S.C. 103 (a) as being unpatentable 
over Bussiere, (6,041,042) in view of See (U.S. 2004/0003094) as applied to claims 1 
and 18 above, and further in view of Haverinen et al. (U.S. 2004/0208151). 

Regarding claim 12, Bussiere-See further discloses pre-configuring the entry 
device to mirror data packets (See, fig. 1 , 106, Source network device is entry device to 
mirror data packet, paragraph 0029). See-Bussiere fails to disclose matching at least 
one access control list (ACL) entry. However, Haverinen, in the same field of endeavor, 



Application/Control Number: 10/723,041 Page 12 

Art Unit: 2145 

discloses matching at least one access control list (ACL) entry (Haverinen, paragraph 
0030) 

It would have been obvious to one have ordinary skill in the art at the time 
of the invention was made to combine the teaching of Haverinen's method to modify in 
Bussiere-See's method. The motivation would have been to improve security of the 
devices. 

Regarding claim 23, Bussiere-See further discloses wherein the specified mirror 
source comprises those packets (See, fig. 1 , 106, Source network device is entry device 
to mirror data packet, paragraph 0029). See-Bussiere fails to disclose matching at least 
one access control list (ACL) entry. However, Haverinen, in the same field of endeavor, 
discloses matching at least one access control list (ACL) entry (Haverinen, paragraph 
0030) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Haverinen's method to modify in 
Bussiere-See's method. The motivation would have been to improve security of the 
devices. 

6. Claims 13-14 and 24-25 are rejected under 35 U.S.C. 103 (a) as being 
unpatentable over Bussiere, (6,041,042) in view of See (U.S. 2004/0003094) as applied 
to claims 1 and 18 above, and further in view of Mullendore et al. (U.S. 2003/0185154). 
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Regarding claim 13, See-Bussiere further discloses configuring the entry device 
(See, fig. 1 , 106, SNS is entry device) in a best effort mirroring mode (the SND 106 
configured to direct a copy of the traffic to another network device without altering the 
contents including the Layer 2 and Layer 3 addressing information of the packets as 
received by original network device, See, Paragraph 0029). See-Bussiere fails to 
disclose reduce head-of- blocking. However, Mullendore, in the same field of endeavor, 
discloses reduce head-of- blocking (Mullendore teaches reduce head-of-blocking and 
network latency, paragraph 0017) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Mullendore's method to modify in 
Bussiere-See's method. The motivation would have been reducing and monitoring 
network congestion operation request received by network device. 

Regarding claim 14, See-Bussiere discloses configuring the entry device 
mirroring made to assure completeness of mirrored traffic (See, paragraph 0029) See- 
Bussiere fails to disclose configuring lossless traffic. However, Mullendore, in the same 
field of endeavor, discloses a lossless traffic (loss of data with in a network traffic, 
Mullendore, paragraph 0010) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Mullendore's method to modify in 
Bussiere-See's method. The motivation would have been reducing and monitoring 
network congestion operation request received by network device. 
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Regarding claim 24, See-Bussiere further discloses the device includes a best 
effort mirroring mode (the SND 106 configured to direct a copy of the traffic to another 
network device without altering the contents including the Layer 2 and Layer 3 
addressing information of the packets as received by original network device, See, 
Paragraph 0029). See-Bussiere fails to disclose reduce head-of-blocking. However, 
Mullendore, in the same field of endeavor, discloses reduce head-of-blocking 
(Mullendore teaches reduce head-of-blocking and network latency, paragraph 0017) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Mullendore's method to modify in 
Bussiere-See's method. The motivation would have been reducing and monitoring 
network congestion operation request received by network device. 

Regarding claim 25, See-Bussiere fails to disclose the device includes a lossless 
mirroring mode to assure completeness of mirrored traffic. However, Mullendore, in the 
same field of endeavor, discloses a lossless traffic (loss of data with in a network traffic, 
Mullendore, paragraph 001 0) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Mullendore's method to modify in 
Bussiere-See's method. The motivation would have been reducing and monitoring 
network congestion operation request received by network device. 
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7. Claims 15-17, and 26-28 are rejected under 35 U.S.C. 103 (a) as being 
unpatentable over Bussiere, (6,041,042) in view of See (U.S. 2004/0003094) as applied 
to claims 1 and 18 above, and further in view of Staheli et al. (5,537,533) 

Regarding claim 15, Bussiere-See further discloses the IP-encapsulated packet 
prior to forwarding thereof address (Bussiere, 26, fig 3, col 5, lines 35-49; col 5, line 65 
to col 6, line 20). Bussiere-See fails to disclose truncating the data packet to reduce a 
size. However, Staheli in the same field of endeavor discloses truncating the data 
packet to reduce a size (Staheli, discloses the computer network's performance reduces 
data size while data being restored in the different device e.g. hard drive, col.3, lines 3- 
9) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Staheli's method to modify in Bussiere- 
See's method. The motivation would have been to increase security of the data 
packets. 

Regarding claim 16, Bussiere-See further discloses the IP-encapsulated packet 
prior to forwarding thereof address (Bussiere, 26, fig 3, col 5, lines 35-49; col 5, line 65 
to col 6, line 20). Bussiere-See fails to disclose compressing the data packet to reduce 
a size. However, Staheli in the same field of endeavor, discloses compressing the data 
packet (Staheli, col. 6, lines 1-3) to reduce a size (Staheli, discloses the computer 
network's performance reduces data size while data being restored in the different 
device e.g. hard drive, col.3, lines 3-9) 
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It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Staheli's method to modify in Bussiere- 
See's method. The motivation would have been to send smaller packets to increase the 
speed of the system. • 

Regarding claim 17, Bussiere-See further discloses forwarding the IP- 
encapsulated (Bussiere, 26, fig 3, col 5, lines 35-49; col 5, line 65 to col 6, line 20). 
Bussiere-See fails to disclose encrypting at least a portion of the data packet to provide 
a level of security prior to. However, Staheli in the same field of endeavor, discloses 
encrypting at least a portion of the data packet to provide a level of security prior to 
(Staheli teaches data encrypted by the primary DTU before it placed to the 
communication link to provide a level of security, (col.5, lines 63-col.6, lines 3) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Staheli's method to modify in Bussiere- 
See's method. The motivation would have been to increase security of the data 
packets. 

Regarding claim 26, Bussiere-See further discloses the IP-encapsulated packet 
prior to forwarding thereof address (Bussiere, 26, fig 3, col 5, lines 35-49; col 5, line 65 
to col 6, line 20). Bussiere-See fails to disclose truncating the data packet to reduce a 
size. However, Staheli in the same field of endeavor, discloses truncating the data 
packet to reduce a size (Staheli, discloses the computer network's performance reduces 
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data size while data being restored in the different device e.g. hard drive, col. 3, lines 3- 
9) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Staheli's method to modify in Bussiere- 
See's method. The motivation would have been to send smaller packets to increase the 
speed of the system. 

Regarding claim 27, Bussiere-See further discloses the IP-encapsulated packet 
prior to forwarding thereof address (Bussiere, 26, fig, 3, col 5, lines 35-49; col 5, line 65 
to col 6, line 20). Bussiere-See fails to disclose compressing the data packet to reduce 
a size. However, Staheli in the same field of endeavor, discloses compressing the data 
packet (Staheli, col.6, lines 1-3) to reduce a size (Staheli, discloses the computer 
network's performance reduces data size while data being restored in the different 
device e.g. hard drive, col.3, lines 3-9) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Staheli's method to modify in Bussiere- 
See's method. The motivation would have been to send smaller packets to increase the 
speed of the system. 

Regarding claim 28, Bussiere-See further discloses IP-encapsulated packet 
(Bussiere, col.5, line 20-50). Bussiere-See fails to disclose the device encrypt at least a 
portion of the data packet to provide a level of security prior to forwarding. However, 



Application/Control Number: 10/723,041 Page 18 

Art Unit: 2145 

Staheli in the same field of endeavor, discloses encrypting at least a portion of the data 
packet to provide a level of security prior to (Staheli teaches data encrypted by the 
primary DTU before it placed to the communication link to provide a level of security, 
(col. 5, lines 63-col.6, lines 3) 

It would have been obvious to one have ordinary skill in the art at the time of the 
invention was made to combine the teaching of Staheli's method to modify in Bussiere- 
See's method. The motivation would have been to increase security of the data 
packets. 



Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Miloushev et al., Pub. No. US 2002/0120763, discloses an apparatus and 
method are provided in a computer network to decouple the client from the server, by 
placing a transparent network node, also termed a file switch or file switch computer, 
between the client an the server. 

Kametani, U.S. Patent No. 6,839,346, discloses a packet switching apparatus 
includes a plurality of lower layer processing units, a table, and a processing unit. 

Cheriton, Pub. No. US 2006/0155875, discloses a system and method for 
efficiently searching long strings of data, such as network messages, as described. 
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Lee, Pub. No. US 2004/0202163, discloses a cell processing method and 
apparatus in an ATM switch can reduce or prevent cell loss and throughput 
deterioration of the switch caused by HOL blocking. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ibrahim Hossain whose telephone number is 571-272- 
9593. The examiner can normally be reached on 9 AM - 5 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jason Cardone can be reached on 571-272-3933. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

IH 

03/16/2007 
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